CVE-2026-91750: Server-Side Request Forgery (SSRF)

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...

PT-2026-68291

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description An authenticated attacker can perform a Path Traversal attack via the Knowledge Bases API endpoint POST /api/v1/knowledge bases. This issue arises because the system uses user-supplied...